Unverified50% confidenceEventExact time
The three open-source projects Pingvin Share X, Better Auth, and AshAuthentication all trusted the email field returned by the OAuth provider without confirming whether the email was verified (or without distinguishing the registration and linking flows), causing a stranger's OAuth login to be bound to someone else's account and achieving account takeover.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/12/2026
First Seen
Valid until: 1/10/2027
Sources
Related Entities
Related Claims
Unverified恶意站点可利用OAuth 2.0协议诱导用户在真实页面授权，从而获得读取邮件、访问云端文件等权限而无需获取密码63% similarUnverifiedThe technology behind connectors uses OAuth authorization or pre-built API integration: after OAuth login, the platform obtains an access token to call APIs on behalf of the user without storing account credentials.63% similarUnverifiedThe OAuth protocol was originally designed to solve the problem of third-party applications accessing resources on behalf of users, with the core mechanism being users authorizing an authorization server in exchange for an access token.62% similarUnverifiedTailscale 采用基于身份的接入模型，通过 OAuth 2.0 / OIDC 协议与 Google Workspace、Microsoft Azure AD、Okta、GitHub 等身份提供商集成，实现单点登录和双因素认证62% similarUnverifiedAI代理访问用户账户主要有两种路径：直接提供账号密码由Agent在云端浏览器登录，或通过OAuth 2.0等授权协议获得有限权限的API Token61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008046API
curl https://kongchang.com/api/v1/knowledge/claims/1008046MCP
get_claim(id=1008046)